- Freeradius-Users - lists.freeradius.org

pam -- how to handle reply attributes
by krishna Mohan 30 Mar '09

30 Mar '09

Hi,I wrote my PAM module (to authenticate a user against Sun AM) for freeRadius and that part is working fine. Now, the PAM module will receive few response attributes from the authenticating application for each user, for whom the authentication is success.How to receive this kind of application specific attributes and how to insert them in Radius-Accept packet? This is an urgent requirement for me.Appreciating your helpThanks,Sri.

2 1

RE: Freeradius 2.1.5 and LDAP+EAP-TLS problem.
by Ville Leinonen 30 Mar '09

30 Mar '09

Hi, Never mind i figure out my problem. I add this line in my configuration: ldap { notfound = reject } So if user is not in my ldap. Then its rejected. Br, Ville -----Original Message----- From: freeradius-users-bounces+ville.leinonen=solodel.com(a)lists.freeradius.org on behalf of Ville Leinonen Sent: Mon 30/03/2009 14:36 To: freeradius-users(a)lists.freeradius.org Subject: Re: Freeradius 2.1.5 and LDAP+EAP-TLS problem. Hi, Maybe im not started this post clearly. So i try open again what i want to do. I have a computer certificates. I also have openldap and that ldap includes my computer accounts. Now I want to use those certificates to authenticate computers and get authorization information inside my ldap. If computers dont have account in my ldap it's rejected. But if i put only ldap in my authorization section radius gives: "No authenticate method (Auth-Type) configuration found for the request: Rejecting the user" If i put also eap in authorization section, the radius uses eap for authorization and give access-accept. Even if user not found in ldap. Br, Ville >Here is some other logs if i use only ldap for authorize section: > >You have butchered the configuration and now you are wondering why it's >not working? If you don't know what you are doing - don't do it. If >you feel the urge to disable something (disbling unused modules is >hardly going to make any impact on preformance) get things working first >- than remove things you feel you must one by one. If you remove >something vital you will know what it was and will be able to put it >back. >Use default configuration. Configure *only* ldap module. Don't make >*any* changes to virtual servers (authorize, authenticate etc.). And it >will work. >Ivan Kalik >Kalik Informatika ISP

1 0

Re: Freeradius 2.1.5 and LDAP+EAP-TLS problem.
by Ville Leinonen 30 Mar '09

30 Mar '09

Hi, Maybe im not started this post clearly. So i try open again what i want to do. I have a computer certificates. I also have openldap and that ldap includes my computer accounts. Now I want to use those certificates to authenticate computers and get authorization information inside my ldap. If computers dont have account in my ldap it's rejected. But if i put only ldap in my authorization section radius gives: "No authenticate method (Auth-Type) configuration found for the request: Rejecting the user" If i put also eap in authorization section, the radius uses eap for authorization and give access-accept. Even if user not found in ldap. Br, Ville >Here is some other logs if i use only ldap for authorize section: > >You have butchered the configuration and now you are wondering why it's >not working? If you don't know what you are doing - don't do it. If >you feel the urge to disable something (disbling unused modules is >hardly going to make any impact on preformance) get things working first >- than remove things you feel you must one by one. If you remove >something vital you will know what it was and will be able to put it >back. >Use default configuration. Configure *only* ldap module. Don't make >*any* changes to virtual servers (authorize, authenticate etc.). And it >will work. >Ivan Kalik >Kalik Informatika ISP

1 0

Re: Freeradius 2.1.5 and LDAP+EAP-TLS problem.
by Ville Leinonen 30 Mar '09

30 Mar '09

Hi, I read that, but what if user not found in ldap? Radius seems to need some auth-type. How i can force auth-type using ldap? My radius gives this message -> "No authenticate method (Auth-Type) configuration found for the request: Rejecting the user" Here is some other logs if i use only ldap for authorize section: rad_recv: Access-Request packet from host 10.10.1.100 port 1024, id=198, length=224 Framed-MTU = 1466 NAS-IP-Address = 10.10.1.100 NAS-Identifier = "8021x" User-Name = "lnx01.demo.local" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 37 NAS-Port-Type = Ethernet NAS-Port-Id = "37" Called-Station-Id = "00-16-b9-55-48-c0" Calling-Station-Id = "00-e0-00-1c-1e-c1" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" EAP-Message = 0x02330016017375736530312e64656d6f2e6c6f63616c Message-Authenticator = 0x5c313918e00d0d385d435e3194c284ed +- entering group authorize {...} ++[preprocess] returns ok [suffix] No '@' in User-Name = "lnx01.demo.local", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [files] users: Matched entry DEFAULT at line 190 ++[files] returns ok [ldap] performing user authorization for lnx01.demo.local [ldap] expand: (cn=%u) -> (cn=lnx01.demo.local) [ldap] expand: ou=8021x,dc=demo,dc=local -> ou=8021x,dc=demo,dc=local rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.10.101.31:389, authentication 0 rlm_ldap: setting TLS CACert Directory to /path/to/ca/dir/ rlm_ldap: bind as cn=Directory Manager/ to 10.10.101.31:389 rlm_ldap: waiting for bind result ... request done: ld 0x9ba2480 msgid 1 rlm_ldap: Bind was successful rlm_ldap: performing search in ou=8021x,dc=demo,dc=local, with filter (cn=lnx01.demo.local) request done: ld 0x9ba2480 msgid 2 [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user suse01.demo.local authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Login incorrect: [suse01.demo.local/<no User-Password attribute>] (from client 8021x port 37 cli 00-e0-00-1c-1e-c1) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> suse01.demo.local attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 198 to 10.10.1.100 port 1024 Waking up in 4.9 seconds. Cleaning up request 0 ID 198 with timestamp +6 Ready to process requests. Br, Ville >We have openldap which includes our machine accounts. We >have also computer certificates. Now what i want to do that freeradius, >checks authorization against ldap and authenticate against certificates. > >I have tested to put ldap to authorization section and eap to authentication >section, but this wont work. I have also tested to put both ldap and eap to >authorization section, but ldap wont return reject if user's noot found. > >Is there any method to return reject for authorization section if user not >found in ldap and stop processing there? Or is there any other method to do this? > >Read doc/rlm_ldap about access_attr. >Ivan Kalik >Kalik Informatika ISP

2 1

Freeradius 2.1.5 and LDAP+EAP-TLS problem.
by Ville Leinonen 30 Mar '09

30 Mar '09

Hi, We have openldap which includes our machine accounts. We have also computer certificates. Now what i want to do that freeradius, checks authorization against ldap and authenticate against certificates. I have tested to put ldap to authorization section and eap to authentication section, but this wont work. I have also tested to put both ldap and eap to authorization section, but ldap wont return reject if user's noot found. Is there any method to return reject for authorization section if user not found in ldap and stop processing there? Or is there any other method to do this? We also have printers, which uses 802.1x mac-auth. Br, Ville Leinonen

2 1

about VSA attribute
by Tseveendorj 30 Mar '09

30 Mar '09

Hello, I'm trying to implement ADSL service via cisco router by NAS, FreeRADIUS 2.1.3 by AAA server and daloRADIUS. On the cisco router I defined some policy-map for traffic shape. In the radgroupreply table contains following attribute with value. "cisco-avpair", ":= ", "ip:sub-policy-Out=512Kbps" Question is How to define 2 difference policy-map on the one user in FreeRADIUS Databse. example: "cisco-avpair", ":= ", "ip:sub-policy-Out=512Kbps" "cisco-avpair", ":= ", "ip:sub-policy-Out=1Mbps" Really appreciate any help. Sincerely, Tseveen

2 4

help
by William Esteves 29 Mar '09

29 Mar '09

I have one answer, maybe its cause im newba in freeradius =] the situation is, sometimes my bd in mysql (that run on another computer) crash or have problems, how can i autenticate all users with any password or any usernames? Then i let my clients coneccted and can fix my db server how can i do this? thanks 4all William Esteves _________________________________________________________________ Confira vídeos com notícias do NY Times, gols direto do Lance, videocassetadas e muito mais no MSN Video! http://video.msn.com/?mkt=pt-br

2 1

running freeradius with eap/tls :(
by Wiem Tounsi 29 Mar '09

29 Mar '09

hello; I have to run freeradius with 802.1X protocol : EAP/TLS. i did all my possible but i had no chance to connect my client (wpa_supplicant with the server).. My AP is also well configured.. here i'll send you the debug I have from freeradius and the client... freeradius detect a signal but there is no connection with EAP/TLS.. please, help me to now the problem.. i'm too late.. thank you . *the outpu of freeradius when trying to connect the client:* root@xxxxt:/usr/local/etc/raddb# radiusd -X -A Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/serveur.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/serveur.pem" tls: CA_file = "/usr/local/etc/raddb/certs/root.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "%{User-Name}" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Accounting-Request packet from host 192.168.0.228:2159, id=12, length=156 Acct-Session-Id = "00000019-00000043" Acct-Status-Type = Start Acct-Authentic = Local User-Name = "001b770fdb97" NAS-IP-Address = 127.0.0.1 NAS-Port = 2 Called-Station-Id = "00-1E-2A-C6-61-58:xxxx" Calling-Station-Id = "00-1B-77-0F-DB-97" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" Processing the preacct section of radiusd.conf modcall: entering group preacct for request 0 modcall[preacct]: module "preprocess" returns noop for request 0 rlm_acct_unique: Hashing 'NAS-Port = 2,Client-IP-Address = 192.168.0.228,NAS-IP-Address = 127.0.0.1,Acct-Session-Id = "00000019-00000043",User-Name = "001b770fdb97"' rlm_acct_unique: Acct-Unique-Session-ID = "2454d13eda8ab416". modcall[preacct]: module "acct_unique" returns ok for request 0 rlm_realm: No '@' in User-Name = "001b770fdb97", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 0 modcall[preacct]: module "files" returns noop for request 0 modcall: leaving group preacct (returns ok) for request 0 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 0 radius_xlat: '/usr/local/var/log/radius/radacct/ 192.168.0.228/detail-20090321' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.0.228/detail-20090321 modcall[accounting]: module "detail" returns ok for request 0 modcall[accounting]: module "unix" returns ok for request 0 radius_xlat: '/usr/local/var/log/radius/radutmp' radius_xlat: '001b770fdb97' modcall[accounting]: module "radutmp" returns ok for request 0 modcall: leaving group accounting (returns ok) for request 0 Sending Accounting-Response of id 12 to 192.168.0.228 port 2159 Finished request 0 Going to the next request --- Walking the entire request list --- Cleaning up request 0 ID 12 with timestamp 49c53da1 Nothing to do. Sleeping until we see a request. *the output of client:* phare@phare:~$ sudo wpa_supplicant -Dwext -iwlan0 -c /etc/wpa_supplicant/wpa_supplicant.conf Associated with 00:1e:2a:c6:61:58 Authentication with 00:1e:2a:c6:61:58 timed out. CTRL-EVENT-SCAN-RESULTS CTRL-EVENT-DISCONNECTED - Disconnect event - remove keys ioctl[SIOCSIWENCODEEXT]: No such file or directory CTRL-EVENT-SCAN-RESULTS CTRL-EVENT-SCAN-RESULTS

2 3

Authentication Digest
by Varadharajan Seshadri 28 Mar '09

28 Mar '09

Hi, I would like to have my SIP clients authenticate with Active Directory (AD). I am using RADIUS in the middle to do the digest based authentication between by sip client and AD. SIP Client ---> RADIUS Client ---> RADIUS Server (IAS of windows server) ----> Activer Directory is my setup. I downloaded RADIUS Client version 1.1.6 (which is the latest i find in freeradius.org) to do the digest based Auth. Following is the AV pair i used to form my Request packet, as per RFC 4590/5090 PW_USER_NAME PW_SERVICE_TYPE PW_DIGEST_REALM PW_DIGEST_METHOD PW_DIGEST_ALGORITHM PW_DIGEST_URI RADIUS server (IAS of Windows) complains of malformed packets. If any of you have used digest based authentication, using Freeradius client, i would like you to help me with this. Also, i am not sure how to add message autehnticator to this request message, which i understand is mandatory. Not sure if this is THE issue. Thanks Varad Windows Live Messenger. Multitasking at its finest. _________________________________________________________________ Twice the fun—Share photos while you chat with Windows Live Messenger. http://www.microsoft.com/india/windows/windowslive/messenger.aspx

2 3

Filtering reply attributes for certain NAS devices
by Paul Hanson 28 Mar '09

28 Mar '09

Quick question (I hope)... What options do I have to limit or mask certain attributes depending upon the NAS device? I have approx 14 devices that need specific attributes but other devices have issues with some optional reply attributes. My current setup uses two LDAP instances, PostgreSQL database, exec scripts for attribute rewrites and I'm using default_profile for global attributes via LDAP and optional per user attributes in LDAP too. As usual, freeradius generally has a multitude of ways to achieve the same task....what options/alternatives/combinations do I have??? Regards ***Disclaimer*** This email and any attachments may contain confidential and/or privileged material; it is for the intended addressee(s) only. If you are not a named addressee, you must not use, retain or disclose such information. The Waterdale Group (3477263), comprising of CPiO Limited (2488682), Ardent Solutions Limited (4807328), eSpida Limited (4021203), Advanced Digital Technology Limited (1750478) and Intellisell (6070355) whilst taking all reasonable precautions against email or attachment viruses, cannot guarantee the safety of this email. The views expressed in this email are those of the originator and do not necessarily represent the views of The Waterdale Group Nothing in this email shall bind The Waterdale Group in any contract or obligation. For further information visit www.waterdalegroup.co.uk

2 1